CVE-2025-67502 Taguette does not safeguard against Open Redirect
Attackers can craft malicious URLs to redirect authenticated users to arbitrary external sites, facilitating phishing attacks against Taguette users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-67502?
CVE-2025-67502 is a medium-severity vulnerability in remram44 taguette, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.
Weakness: CWE-601
Which versions are affected by CVE-2025-67502?
3 open source packages ship an affected version, including taguette. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
taguette PyPI | All versions | 1.5.2 |
taguette PyPI | All versions | 1.5.2 |
taguette PyPI | All versions | 1.5.2 |
Products include Taguette Taguette.
How do I fix CVE-2025-67502?
Upgrade taguette to 1.5.2 or later.
Is CVE-2025-67502 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67502 exists.
Other vulnerabilities in remram44 taguette
Sources
Also known as GHSA-5923-r76v-mprm, PYSEC-2026-1948.